diff --git a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
index 8532f1c6df047..d74f71d9f270c 100644
--- a/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
+++ b/Source/JavaScriptCore/bytecode/SpeculatedType.cpp
@@ -602,7 +602,9 @@ SpeculatedType speculationFromCell(JSCell* cell)
     if (cell->isString()) {
         JSString* string = uncheckedDowncast<JSString>(cell);
         if (const StringImpl* impl = string->tryGetValueImpl()) {
-            if (!Integrity::isSanePointer(impl)) [[unlikely]] {
+            // Alignment check rejects HeapCell::zap residue in m_fiber seen on weak-memory-order
+            // CPUs when a freshly-allocated JSString is read before its m_fiber store is visible.
+            if (!Integrity::isSanePointer(impl) || (reinterpret_cast<uintptr_t>(impl) & (alignof(StringImpl) - 1))) [[unlikely]] {
                 ASSERT_NOT_REACHED();
                 return SpecNone;
             }